Hey everyone this is Alexandra Huft,
I wanted to let people know that we just posted Microsoft Security Advisory (932114). This involves an issue that only affects Microsoft Word 2000. We’ve activated our Software Security Incident Response Process (SSIRP) and have some information we can share from the investigation so far.
We are currently investigating a report of a posting of proof of concept code which could allow an attacker to execute code on a user’s machine in their security context by convincing them to open a specially-crafted Word document.
We are aware of very limited, targeted attacks attempting to use the vulnerability reported.
In the past, we have gotten some question from customers about what we mean when we say we’re aware of “very limited, targeted attacks” in a security advisory. I wanted to remind you that we have a posting where we explain what we mean posted here.
As part of our investigation, we will be working with our MSRA partners to monitor and secure the ecosystem.
I will keep everyone up to date as new or additional information becomes available.
Thanks,
Alexandra
*This posting is provided “AS IS” with no warranties, and confers no rights.*